How to Manage Windows Defender Firewall Rules in Windows 11 Using PowerShell

Securing network endpoints against unauthorised intrusions and managing application communications is a cornerstone of system administration. While the graphical Windows Defender Firewall with Advanced Security snap-in (wf.msc) is familiar to many users, navigating deep graphical trees to audit dozens of ports or deploy identical filters across multiple machines is slow and error-prone. Modern Windows 11 environments include the dedicated NetSecurity PowerShell module, providing direct, scriptable control over firewall states, network profiles, and granular packet rules. Learning how to manage firewall rules in Windows 11 using PowerShell enables you to automate inbound port allowances, block outbound telemetry, and inspect security filters with speed and precision.

Opening an Elevated PowerShell Session in Windows 11

Manipulating firewall configurations alters system-level networking policies and strictly requires local administrator permissions:

1. Right-click the Start button on the Windows 11 taskbar (or press Windows Key + X).
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes when prompted by the User Account Control (UAC) dialogue.

Checking Overall Windows Firewall Profile Status

Windows Defender Firewall operates across three distinct network profiles: Domain, Private, and Public. To inspect whether each profile is enabled and verify default inbound/outbound behaviours:

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | Format-Table -AutoSize

By default, Windows blocks incoming connections that do not match an explicit allowance rule while allowing outbound traffic.

Querying and Filtering Existing Firewall Rules

Windows 11 contains hundreds of default rules for operating system services and pre-installed apps. You can query specific rules using Get-NetFirewallRule:

Listing Active Rules by Display Name:

Get-NetFirewallRule -DisplayName "*Remote Desktop*" | Select-Object DisplayName, Direction, Action, Enabled | Format-Table -AutoSize

Filtering Rules by Open TCP/UDP Ports:

To inspect which firewall rules explicitly filter traffic on a specific port (for instance, web traffic on port 80 or 443), pipe the rule objects into Get-NetFirewallPortFilter:

Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True'} | Get-NetFirewallPortFilter | Where-Object {$_.LocalPort -eq '443'} | Format-Table -AutoSize

Creating New Inbound and Outbound Firewall Rules

The New-NetFirewallRule cmdlet allows you to define custom packet-filtering conditions in a single command line.

Opening an Inbound Port (e.g. Local Development Server on Port 8080):

New-NetFirewallRule -DisplayName "Allow Dev Server 8080" -Direction Inbound -LocalPort 8080 -Protocol TCP -Action Allow -Profile Private

This command creates an inbound TCP rule restricted specifically to trusted Private networks, preventing external public Wi-Fi networks from reaching your local development services.

Blocking an Outbound Application:

To prevent a specific desktop software binary from initiating outbound internet connections:

New-NetFirewallRule -DisplayName "Block Untrusted App Outbound" -Direction Outbound -Program "C:\Program Files\ExampleApp\app.exe" -Action Block -Profile Any

Modifying and Toggling Existing Firewall Rules

Rather than deleting and recreating rules when network conditions change, use Set-NetFirewallRule to adjust parameters dynamically.

Disabling a Rule Temporarily:

Set-NetFirewallRule -DisplayName "Allow Dev Server 8080" -Enabled False

Re-enabling a Disabled Rule:

Set-NetFirewallRule -DisplayName "Allow Dev Server 8080" -Enabled True

Updating Allowed Remote Subnets:

To restrict an existing rule so that only a specific administrative subnet can connect:

Set-NetFirewallRule -DisplayName "Allow Dev Server 8080" -RemoteAddress 192.168.1.0/24

Deleting Firewall Rules Cleanly

When custom development ports or temporary application rules are no longer needed, purge them using Remove-NetFirewallRule:

Remove-NetFirewallRule -DisplayName "Allow Dev Server 8080"

PowerShell will delete the specified rule without leaving orphan entries in the Windows registry.

Managing Windows Defender Firewall through PowerShell NetSecurity cmdlets provides unmatched speed, reproducibility, and automation potential. Whether building secure provisioning scripts or auditing open ports on an endpoint, mastering these commands ensures robust network defence across all your Windows 11 devices.